Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 09:18

General

  • Target

    45dce586847b9a88a5e803b5c7d1f5f3.exe

  • Size

    385KB

  • MD5

    45dce586847b9a88a5e803b5c7d1f5f3

  • SHA1

    b2af12ec5f7a6c9404c96ee1be174b4fa76c935c

  • SHA256

    8c9de6f89be0268a42a7365b6db0098a93e7cf4cda63bc79cda5132a09123180

  • SHA512

    6893a39aff7bf36592878e152b0b1ff3dd368bd693de8b923327d88e9762b5325e0a69e2299a73655d368e089673d8733307682dcc60af3d3883f6812e7f8d62

  • SSDEEP

    6144:0UhUKqlRScjcgBcjYcyS6cyexjXV1zbpILk8fOShrTANibhYqB:R1icFyS6crjFThSh/NLB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45dce586847b9a88a5e803b5c7d1f5f3.exe
    "C:\Users\Admin\AppData\Local\Temp\45dce586847b9a88a5e803b5c7d1f5f3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Local\Temp\45dce586847b9a88a5e803b5c7d1f5f3.exe
      C:\Users\Admin\AppData\Local\Temp\45dce586847b9a88a5e803b5c7d1f5f3.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:1168

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\45dce586847b9a88a5e803b5c7d1f5f3.exe

    Filesize

    206KB

    MD5

    5ade2d81d65691ea7faa5f14bf698e3e

    SHA1

    d8d0308bb80e32445af3a01ff735c13b18cd2221

    SHA256

    81b5bb1422ba92afae89db97456f59023769672d599bca381d071aa149d4565e

    SHA512

    b953833c9ffb340a0e2e98b2cf7ead2141f5cb90d286426b954b05bb238e39f9d06e9eaa2518548df40c9e5471257f8529041c4fb7ea1ada5f0c56d898b0d554

  • C:\Users\Admin\AppData\Local\Temp\Cab45C9.tmp

    Filesize

    38KB

    MD5

    4ccf0d564bafda60be7190b7b3701bda

    SHA1

    97bc56c7664d28191ea1c69c48fd1ab5f0afc395

    SHA256

    e138dad4f29540b215d28cb7306346c21a5b8239917b2b7e312f1750996b3c04

    SHA512

    d99d540781dba735bb49045f0ef46e6f30244be52d8ea40e652a929aae460098ff75db3c89e6daaf9a20e8e3378b0436851c76fce0a9d0b8cb2fd5720a44e7df

  • C:\Users\Admin\AppData\Local\Temp\Tar45FB.tmp

    Filesize

    64KB

    MD5

    69b8e2fe3bb7142b759bbc3bd3092cc2

    SHA1

    c55b032e44415d77a1a2f3f6c6c049b7cc32afd7

    SHA256

    d31cf766104ab57466eca8c74b0b1dc3f7729270b60df98dde747087ec3e8bb4

    SHA512

    c3b3ca6861a0e35822f0c5b6085f7fc1444b051548aec4362723d1b7a14b72cd832335ca29eea23ce8f9fb71f4ac76c6bf2b58a220722e7843461bf095970b7b

  • \Users\Admin\AppData\Local\Temp\45dce586847b9a88a5e803b5c7d1f5f3.exe

    Filesize

    255KB

    MD5

    8522c125ca654401f8a6cea51b66a6b1

    SHA1

    99ceb966e3694a4c38a7b63905bf4c54058709f2

    SHA256

    992bcc670f0a26445cf64d15aeebed47521ae8bc68df6f6442ad25deb601464d

    SHA512

    48427cca801a0263e94b0417fa417638b53cd5cf4f4160bbcd8a0d7f7fdc9a93640e1f1aaa7884d479c02213b32fee1a9712cec7d09766d8182e4a60644e37ed

  • memory/1168-15-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/1168-22-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1168-24-0x0000000000240000-0x000000000029F000-memory.dmp

    Filesize

    380KB

  • memory/1168-16-0x0000000000190000-0x00000000001F6000-memory.dmp

    Filesize

    408KB

  • memory/1168-76-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1168-82-0x000000000EA00000-0x000000000EA3C000-memory.dmp

    Filesize

    240KB

  • memory/1168-81-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2668-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2668-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2668-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2668-2-0x0000000000190000-0x00000000001F6000-memory.dmp

    Filesize

    408KB